Compile error during assignment to double-pointer with bounds-safe interface

[nmeum]

Consider the following code:

#include <stdio.h>

void
myfunc(int **outval : itype(_Ptr<_Ptr<int>>)) {
	static int val = 5;

	_Ptr<int> myptr = &val;

	// Doesn't work:
	*outval = myptr;
	// This does work:
	/* *outval = &val; */
}

int
main(void)
{
	int *myval;

	myfunc(&myval);
	printf("myval = %d\n", *myval);
}

This does not compile with the following error message:

$ clang -o test test.c
test.c:10:10: error: assigning to 'int *' from incompatible type '_Ptr<int>'
        *outval = myptr;
                ^ ~~~~~
1 error generated

If the code is changed according to the comment in myfunc it does compile. Alternatively, it does also compile successfully if myfunc() uses Checked C pointer types directly instead of using a bound-safe interface. I find this a bit surprising, is this is a bug or intended behaviour?

[kkjeer]

Hi @nmeum, thank you for opening this issue! This is currently not covered by the Checked C specification. We've opened issues #810 and microsoft/checkedc/#397 to track the implementation and spec updates for this case.